Proof of concept implementation of a cyber threat intelligence and incident handling platform

zeroq, updated 🕥 2023-02-10 23:09:13

Kraut Salad

Current Status

Currently, the basic database design is complete and a first parser for MITRE' STIX and CybOX cyber threat intelligence exchange formats is written. Kraut Salad is supposed to be a proof of concept implementation to determine if a relational database model is feasible or not. Therefore, Kraut Salad only implements a subset of the MITRE standard and still requires some CybOX objects to be implemented.

Further documentation can be found at kraut-salad.readthedocs.org

Requirements

Please refer to requirements.txt for an updated list of required packages.

Test Documents

Kraut Salad has been tested with: * Mandiant APT1 Report * FireEye Poison Ivy Report

Both available at https://stix.mitre.org/language/version1.0.1/samples.html

Usage

To load a STIX documents into the database either point at a particular file directly or just at the directory containing several documents:

python python manage.py load_stix report.xml

The output will be something like this ``` --> performing version check ... found 1.1.1 ... [DONE] --> extracting stix package information ... [DONE] --> extracting observable information ... [DONE]

Missing references for: object_2_object namespace:File-01d04d81-697c-489c-8340-e1b93332b87c -> {'id': u'namespace:HTTPSession-9765c645-8cdd-43e2-9df3-af6a66eb97ba', 'relationship': u'Connected_To'}

Missing stix elements: Missing stix element implementation: timestamp

Missing Object Types: Missing object type implementation: HTTPSessionObjectType Missing object type implementation: WindowsExecutableFileObjectType

```

The Kraut parser will tell you about missing object references, STIX elements, and CybOX objects at the end of the run.

Roadmap

The following items describe what is still planned but has no particular order:

add more CybOX objects (e.g. ProcessObject, HTTPSessionObject, ...)
add support for IOC format
create a webinterface to browse and modify threat intelligence data (work in progress ...)
create an interface to neo4js graph database
create a webinterface to track and handle incidents
associate threat intelligence data with assets detected during an incident

Issues

Bump ipython from 7.16.3 to 8.10.0

opened on 2023-02-10 23:09:12 by dependabot[bot]

Bumps ipython from 7.16.3 to 8.10.0.

Release notes

Sourced from ipython's releases.

See https://pypi.org/project/ipython/

We do not use GitHub release anymore. Please see PyPI https://pypi.org/project/ipython/

Commits

15ea1ed release 8.10.0
560ad10 DOC: Update what's new for 8.10 (#13939)
7557ade DOC: Update what's new for 8.10
385d693 Merge pull request from GHSA-29gw-9793-fvw7
e548ee2 Swallow potential exceptions from showtraceback() (#13934)
0694b08 MAINT: mock slowest test. (#13885)
8655912 MAINT: mock slowest test.
a011765 Isolate the attack tests with setUp and tearDown methods
c7a9470 Add some regression tests for this change
fd34cf5 Swallow potential exceptions from showtraceback()
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/zeroq/kraut_salad/network/alerts).

Bump certifi from 2019.3.9 to 2022.12.7

opened on 2022-12-08 05:00:29 by dependabot[bot]

Bumps certifi from 2019.3.9 to 2022.12.7.

Commits

9e9e840 2022.12.07
b81bdb2 2022.09.24
939a28f 2022.09.14
aca828a 2022.06.15.2
de0eae1 Only use importlib.resources's new files() / Traversable API on Python ≥3.11 ...
b8eb5e9 2022.06.15.1
47fb7ab Fix deprecation warning on Python 3.11 (#199)
b0b48e0 fixes #198 -- update link in license
9d514b4 2022.06.15
4151e88 Add py.typed to MANIFEST.in to package in sdist (#196)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

Bump lxml from 4.6.5 to 4.9.1

opened on 2022-07-06 21:27:12 by dependabot[bot]

Bumps lxml from 4.6.5 to 4.9.1.

Changelog

Sourced from lxml's changelog.

4.9.1 (2022-07-01)

Bugs fixed

A crash was resolved when using iterwalk() (or canonicalize()) after parsing certain incorrect input. Note that iterwalk() can crash on valid input parsed with the same parser after failing to parse the incorrect input.

4.9.0 (2022-06-01)

Bugs fixed

GH#341: The mixin inheritance order in lxml.html was corrected. Patch by xmo-odoo.

Other changes

Built with Cython 0.29.30 to adapt to changes in Python 3.11 and 3.12.

Wheels include zlib 1.2.12, libxml2 2.9.14 and libxslt 1.1.35 (libxml2 2.9.12+ and libxslt 1.1.34 on Windows).

GH#343: Windows-AArch64 build support in Visual Studio. Patch by Steve Dower.

4.8.0 (2022-02-17)

Features added

GH#337: Path-like objects are now supported throughout the API instead of just strings. Patch by Henning Janssen.

The ElementMaker now supports QName values as tags, which always override the default namespace of the factory.

Bugs fixed

GH#338: In lxml.objectify, the XSI float annotation "nan" and "inf" were spelled in lower case, whereas XML Schema datatypes define them as "NaN" and "INF" respectively.

... (truncated)

Commits

d01872c Prevent parse failure in new test from leaking into later test runs.
d65e632 Prepare release of lxml 4.9.1.
86368e9 Fix a crash when incorrect parser input occurs together with usages of iterwa...
50c2764 Delete unused Travis CI config and reference in docs (GH-345)
8f0bf2d Try to speed up the musllinux AArch64 build by splitting the different CPytho...
b9f7074 Remove debug print from test.
b224e0f Try to install 'xz' in wheel builds, if available, since it's now needed to e...
897ebfa Update macOS deployment target version from 10.14 to 10.15 since 10.14 starts...
853c9e9 Prepare release of 4.9.0.
d3f77e6 Add a test for https://bugs.launchpad.net/lxml/+bug/1965070 leaving out the a...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

[ ] Campaign
[ ] TTPs
[ ] Indicators
[ ] Observables
[ ] Malware Instances
[ ] Attack Patterns

zeroq

GitHub Repository

python threat-intelligence stix cybox

Proof of concept implementation of a cyber threat intelligence and incident handling platform

Kraut Salad

Current Status

Requirements

Test Documents

Usage

Roadmap

Issues

Bump ipython from 7.16.3 to 8.10.0

See https://pypi.org/project/ipython/

Bump certifi from 2019.3.9 to 2022.12.7

Bump lxml from 4.6.5 to 4.9.1

4.9.1 (2022-07-01)

Bugs fixed

4.9.0 (2022-06-01)

Bugs fixed

Other changes

4.8.0 (2022-02-17)

Features added

Bugs fixed

[Kraut salad] Upgrade to Python 3.x

[Kraut salad] Upgrade to Django 2.x

[Kraut intel] create new items

zeroq